Auto update systems - yes or no

Started by
15 comments, last by dilyan_rusev 10 years, 2 months ago

I like SourceTree's auto updater:

Every time there's an update, there are three buttons:

  • Update (the rest happens automatically)
  • Remind me tomorrow
  • Don't ask me ever again.

I'd say there's a missing "Always update automatically"; All 4 options should cover everyone's tastes.

IMo much better is do not show such things at all, only give

some button or menu postition "update" (maybe some modest information update is avaliable but not on a main screen )

I am also strongly against for programs auto adding background things services etc

Advertisement


What I really dislike is executable services running in the background of my computer 24/7 constantly checking for updates. jucheck.exe / jusched.exe I'm look at you.
I think Apple has one too, and Adobe sometimes, and Google (gupdate, gupdatem, apparently),

Same here. Some even add themselves back to the startup list even after you remove them so I have to resort to nuking them from the disk or terminating them after each boot. I don't mind if a small separate application is launched in order to patch the main binary upon update, but update checking should be made explicit. Even a small popup such as "a new update is available" with options "update now" and "go away and don't remind me every single time I launch the program" would be acceptable, but ideally updates are handled by the operating system itself or a software manager such as Steam for games, and should definitely not leave crapware running in the background 24/7.

“If I understand the standard right it is legal and safe to do this but the resulting value could be anything.”

I like being notified of updates, but not constantly bugged. I hate if software secretly does something behind my back, including updating to another version.

Program auto-updates are insofar troublesome as it means many useless services running and many opportunities for security risks and stability issues. I really hate having an extra Windows service running only to update Google products (which is one reason why no Google products are running on my computers) and another service running to update my Logitech mouse driver (WTF?), and yet another one to update XYZ.

I would very much prefer if update with optional auto-update was integrated into operating systems. That is already kind of the case with all those "stores" (Microsoft, Apple, Steam, whatever), but that's not what I'm thinking about. Developers shouldn't have to ask Microsoft or Apple what software they' are "allowed" to distribute and/or update.

Ideally, when installing a program, it should call some API function (or system tool) that registers the program with an update server and a cryptographic key. From that point on, the operating system takes over update management, it handles regularly checking (maybe once per day, as configured by the user) update servers, and prompting for updates when they're available, it downloads and copies files, etc. No need to run a number of possibly broken updater programs with administrative rights.

Some Linux distros almost work that way, but not yet quite. It "kind of works" if you are willing to edit obscure repo config files by hand.

They'll be getting there though... now if only Windows was anything the like.


That is already kind of the case with all those "stores" (Microsoft, Apple, Steam, whatever), but that's not what I'm thinking about. Developers shouldn't have to ask Microsoft or Apple what software they' are "allowed" to distribute and/or update.

I don't know - the entire value of update-via-store to me is that someone like Apple is gating the updates.

The number of times I have had to abandon third party software (even from large software companies) because an update renders it unusable, is pretty high.

Tristam MacDonald. Ex-BigTech Software Engineer. Future farmer. [https://trist.am]

The number of times I have had to abandon third party software (even from large software companies) because an update renders it unusable, is pretty high.

Luckily, I see those very rarely. Java being one I remember a couple of years back, but I haven't even installed Java on any of my computers now, due to that long-standing bypass-sandbox issue which Oracle didn't seem to worry much about for ages (is that fixed in the mean time?).

MS Office update-destroyed itself once about 10 years ago, but I've not used that software for years either.

I remember having update troubles with WorldMachine 2.2 Pro when it came out, but that was merely the installer being bugged and not finding the installation (the program still worked, only didn't upgrade).

Here is an example of what I think is wrong with auto updates:

Thunderbird just (few mins ago) came up with a notification that it has a new version available. Consequentially, I click on "OK, upgrade" so it stops bugging me. Some progress bar comes up while it downloads stuff, and then UAC prompts me "Do you want to allow Thunderbird to make changes to your computer?".

Which is the moment I'm starting to shout "Fuck, no. I don't want to allow it to make changes to my computer. I want to allow it to update its own executable, and nothing else. And above all, I certainly do not want to run a program which connects to the internet and receives emails as administrator". But I have no choice but to click "Yes" because it will not otherwise work, and it will keep bugging me, rendering the computer unusable.

Now if this was "Microsoft Program Update Service" telling me: "A new version of the program "Thunderbird" is available (Version blah, [security update, recommended], signed by Blahblah). Click here to show a list of pathnames that will be overwritten/modified." it would be an entirely different story. The system's update service doesn't receive emails with malware attachments, so giving it administrative privilegues is a lot less risky. And with a slightly more intelligent, more fine-grained security system, updating non-operating-system programs should not require admin privilegues anyway. It is also highly likely that a system-wide updater that is used daily by hundreds of million users is mostly error-free due to its test coverage (much more than your selfmade updater as an indie developer if you have maybe 2,500 users alltogether and do three updates per year).

But of course that's only desirable if it works for every program, not just the ones that comply with some haphazard company policy and possibly have to acquire permission or a "license", and if it itsn't maximally obscure (like it usually is, unluckily).

It is for example possible to update nVidia display drivers in this exact way even under good old Win7, using standard Windows Update. Except of course it's a maximally obscure hidden process, with "install everything" settings, even if you have opted out installing PhysiX and that new video recording and mobile streaming stuff previously.


And with a slightly more intelligent, more fine-grained security system, updating non-operating-system programs should not require admin privilegues anyway.

That's fine for tech-savvy consumers, but what about in a corporate environment? Hell if I am going to be responsible for the security of the corporate network if random users can apply untested updates to their programs... We'd need a whole other set of permissions to determine individual user's access to the update service.

Tristam MacDonald. Ex-BigTech Software Engineer. Future farmer. [https://trist.am]


And with a slightly more intelligent, more fine-grained security system, updating non-operating-system programs should not require admin privilegues anyway.

That's fine for tech-savvy consumers, but what about in a corporate environment? Hell if I am going to be responsible for the security of the corporate network if random users can apply untested updates to their programs... We'd need a whole other set of permissions to determine individual user's access to the update service.

In a corporate environment, the updater service will be configured to run updates without user interaction, or without giving the user a choice. That's pretty much "standard" for many years. Except it sucks, because it's some half-assed homebrew stuff which fails all the time.

I regularly see this with my wife's laptop which is such a "corporate machine". It will perform updates without asking at inappropriate times, then pop up a warning that the machine will reboot in 30 seconds, and reboot. Three out of four times, this works well. In the remaining case, she has to call tech support afterwards because either a crucial component (like e.g. Outlook) or the whole system doesn't work any more.

Local tech support will as usually waste one hour of work time doing the usual "Try to reboot, you stupid luser" dance, which of course does nothing at all. After that they'll redirect to tech support India who will create a ticket and do nothing for 3 days. After 3 days, they come back to her, telling that she needs to make a backup (on a non-working computer!) hand in the computer at local tech support who will re-image the harddisk within 3 working days.

Meanwhile she has ordered a replacement system (which takes only one day, not a week) because she can't be bothered with that crap.

All in all, this update procedure costs the company a 5 digit sum every time it fails.

Being a game oriented site...

Quake Live uses a launcher app, which checks for updates each time it is run. It any updates are available it forces an update. In situations like that, I'm totally fine.

I'm not fine (like others have said) when crappy adobe or other software creates a "quicklaunch" app which by default run at boot time.

I just cant stand when I have nothing but a text editor open and I see random spikes and shapes in the CPU graph. ....like "something happening silently". If I see that it means one of my apps will be removed or firewalled shortly.

From what I gather, everybody says what they like from a user's perspective. As a business owner, I'd say auto-update is a very nice thing to have. It lets you fix bugs, add new content - and most importantly - you support only the latest version.

For technical users I guess everything that is less than obvious is kind of annoying, but given that our target audience is, to put it mildly, not tech savvy, this is the best thing to keep them happy. Our users actually appreciate that we release updates often. The only problems we've had is crazy firewalls and anti-virus software that doesn't believe in digitally signed executables. Like, not allowing your installer to create a file called "uninstall.exe", or vetoing read-access to files in your own directory :D

Like others have said, the most important thing is what your target audience is. For geeks, auto-updates may raise privacy concerns. For most people, as long as you don't interrupt their experience and deliver value with your upgrades, it is perfectly OK.

This topic is closed to new replies.

Advertisement